@takosjp/yurucommu-core 3.3.0 → 3.4.1

package/migrations/0022_inbound_dispatch_claims.sql

@@ -0,0 +1,17 @@
+-- Fence concurrent/retried ActivityPub inbox dispatches.
+--
+-- `activities.processed = 0` says an activity is retryable, but it does not say
+-- whether another Worker is actively dispatching it. Keeping the lease in a
+-- separate table preserves the public activities ledger shape and lets a
+-- crashed owner expire without allowing an old owner to commit over a newer
+-- retry.
+
+CREATE TABLE IF NOT EXISTS inbound_activity_claims (
+  activity_ap_id TEXT PRIMARY KEY,
+  processing_token TEXT,
+  lease_expires_at TEXT,
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+);
+
+CREATE INDEX IF NOT EXISTS inbound_activity_claims_lease_idx
+  ON inbound_activity_claims(lease_expires_at);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takosjp/yurucommu-core",
-  "version": "3.3.0",
+  "version": "3.4.1",
   "license": "AGPL-3.0-only",
   "type": "module",
   "workspaces": [
@@ -59,7 +59,7 @@
     "start": "bun src/backend/server.ts",
     "dev": "bun src/backend/server.ts",
     "dev:server": "bun src/backend/server.ts",
-    "check": "tsc --noEmit && bun run check:no-opentofu-artifacts",
+    "check": "bun run fmt:check && tsc --noEmit && bun run check:no-opentofu-artifacts && bun run test",
     "check:no-opentofu-artifacts": "bun scripts/check-no-opentofu-artifacts.mjs",
     "test": "bun run build:api && bun test test/ src/backend/ packages/api/src/ scripts/check-publish-version-discipline.test.ts scripts/publish-package-resumable.test.ts && bun run check:release-contents",
     "test:backend": "bun test src/backend/",
@@ -82,6 +82,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.971.0",
     "@libsql/client": "^0.17.0",
+    "@takosjp/takosumi-contract": "^1.0.0",
     "better-sqlite3": "^12.4.1",
     "drizzle-orm": "^0.45.1",
     "fdir": "^6.5.0",

package/packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takosjp/yurucommu-api",
-  "version": "3.3.0",
+  "version": "3.4.0",
   "description": "Typed client SDK and public API contract for yurucommu-server clients.",
   "license": "AGPL-3.0-only",
   "type": "module",

package/packages/api/src/index.ts

@@ -1,5 +1,6 @@
 export * from "./lib/api.ts";
 export * from "./lib/transport.ts";
 export * from "./lib/rtc-client.ts";
+export * from "./lib/realtime-client.ts";
 export * from "./social-server.ts";
 export * from "./types/index.ts";

package/packages/api/src/lib/api/notifications.ts

@@ -39,6 +39,7 @@ export async function fetchNotifications(options?: {
 
 export async function fetchUnreadCount(): Promise<number> {
   const res = await apiFetch("/api/notifications/unread/count");
+  await assertOk(res, "Failed to load unread notification count");
   const data = (await res.json()) as { count?: number };
   return data.count || 0;
 }

package/packages/api/src/lib/api/posts.ts

@@ -169,6 +169,7 @@ export async function fetchBookmarks(options?: {
   if (options?.before) params.set("before", options.before);
   const query = params.toString() ? `?${params}` : "";
   const res = await apiFetch(`/api/bookmarks${query}`);
+  await assertOk(res, "Failed to load bookmarks");
   const data = (await res.json()) as PostListResponse & {
     next_cursor?: string | null;
     has_more?: boolean;

package/packages/api/src/lib/rtc-client.ts

@@ -313,9 +313,7 @@ export class CallClient {
     }
   }
 
-  private onRinging(
-    frame: Extract<HubToClientFrame, { t: "ringing" }>,
-  ): void {
+  private onRinging(frame: Extract<HubToClientFrame, { t: "ringing" }>): void {
     if (this.call) {
       // Already busy — auto-decline the second ring.
       this.send({ t: "reject", callId: frame.callId, reason: "busy" });

package/packages/api/src/types/call.ts

@@ -27,13 +27,7 @@ export interface CallMediaKind {
 
 /** Cross-instance signaling message kinds (Matrix-VoIP inspired). */
 export type RtcSignalType =
-  | "offer"
-  | "answer"
-  | "candidate"
-  | "accept"
-  | "reject"
-  | "hangup"
-  | "cancel";
+  "offer" | "answer" | "candidate" | "accept" | "reject" | "hangup" | "cancel";
 
 /**
  * Selected SFU focus for a group call. `null`/absent means pure P2P (1:1).
@@ -286,9 +280,7 @@ export function parseRtcSignalEnvelope(
     candidates: parseCandidates(input.candidates),
     sfuFocus: parseSfuFocus(input.sfuFocus),
     reason:
-      typeof input.reason === "string"
-        ? input.reason.slice(0, 200)
-        : undefined,
+      typeof input.reason === "string" ? input.reason.slice(0, 200) : undefined,
     ts,
     ttlMs,
   };

package/packages/api/src/types/index.ts

@@ -1,6 +1,9 @@
 // Call signaling wire contract + browser<->hub frames (voice + video).
 export * from "./call.ts";
 
+// Realtime stream wire contract (per-user event feed + control frames).
+export * from "./realtime.ts";
+
 // ===== Yurucommu AP-Native Types =====
 
 // Actor represents a user (Person) in ActivityPub

package/packages/api/src/types/realtime.ts

@@ -0,0 +1,139 @@
+/**
+ * Realtime stream wire contract (browser <-> per-user RealtimeStreamDO).
+ *
+ * One authenticated WebSocket per user carries every live update the client
+ * used to poll for: talk messages, typing, read receipts, contact-list
+ * changes, new notifications, and the authoritative unread counters. The
+ * server pushes `RealtimeEvent` envelopes; the client sends only the small
+ * control frames below (writes stay on the REST API).
+ *
+ * Event ids are a per-user monotonic sequence assigned by the Durable Object.
+ * A reconnecting client offers its last seen id in `hello`; the DO replays the
+ * gap from its ring buffer, or answers `resync` when the gap is older than the
+ * buffer so the client re-fetches via the normal REST reads.
+ */
+
+export type RealtimeEventType =
+  | "talk.message"
+  | "talk.typing"
+  | "talk.read"
+  | "talk.contacts_changed"
+  | "notification.new"
+  | "unread";
+
+export interface RealtimeEvent {
+  /** Per-user monotonic sequence number (assigned by the stream DO). */
+  id: number;
+  type: RealtimeEventType;
+  data: Record<string, unknown>;
+}
+
+/** `talk.message` payload. `other_ap_id` is from the RECEIVING user's view. */
+export interface TalkMessageEventData {
+  kind: "dm" | "community";
+  /** DM: the counterpart actor (per-recipient). */
+  other_ap_id?: string;
+  /** Community chat: the community actor. */
+  community_ap_id?: string;
+  conversation_id?: string;
+  message: {
+    id: string;
+    sender: {
+      ap_id: string;
+      username: string;
+      preferred_username: string | null;
+      name: string | null;
+      icon_url: string | null;
+    };
+    content: string | null;
+    attachments?: unknown[];
+    created_at: string | null;
+  };
+}
+
+export interface TalkTypingEventData {
+  other_ap_id: string;
+  is_typing: boolean;
+  typed_at: string;
+}
+
+export interface TalkReadEventData {
+  other_ap_id: string;
+  conversation_id: string;
+  last_read_at: string;
+}
+
+/** Authoritative unread counters (server-computed; never client-derived). */
+export interface UnreadEventData {
+  dm: number;
+  community: number;
+  talk_total: number;
+  notifications: number;
+}
+
+// --- Client -> server frames -------------------------------------------------
+
+export type RealtimeClientFrame =
+  { t: "hello"; lastEventId?: number } | { t: "ping" } | { t: "pong" };
+
+// --- Server -> client frames -------------------------------------------------
+
+export type RealtimeServerFrame =
+  | { t: "hello_ok"; lastEventId: number }
+  | { t: "event"; event: RealtimeEvent }
+  /** The requested replay gap is older than the buffer: re-fetch via REST. */
+  | { t: "resync" }
+  | { t: "ping" }
+  | { t: "pong" };
+
+export function parseRealtimeClientFrame(
+  raw: unknown,
+): RealtimeClientFrame | null {
+  if (!raw || typeof raw !== "object") return null;
+  const frame = raw as { t?: unknown; lastEventId?: unknown };
+  if (frame.t === "ping" || frame.t === "pong") return { t: frame.t };
+  if (frame.t === "hello") {
+    const lastEventId =
+      typeof frame.lastEventId === "number" &&
+      Number.isFinite(frame.lastEventId) &&
+      frame.lastEventId >= 0
+        ? Math.floor(frame.lastEventId)
+        : undefined;
+    return { t: "hello", lastEventId };
+  }
+  return null;
+}
+
+export function parseRealtimeServerFrame(
+  raw: unknown,
+): RealtimeServerFrame | null {
+  if (!raw || typeof raw !== "object") return null;
+  const frame = raw as { t?: unknown; event?: unknown; lastEventId?: unknown };
+  if (frame.t === "ping" || frame.t === "pong" || frame.t === "resync") {
+    return { t: frame.t };
+  }
+  if (frame.t === "hello_ok" && typeof frame.lastEventId === "number") {
+    return { t: "hello_ok", lastEventId: frame.lastEventId };
+  }
+  if (frame.t === "event" && frame.event && typeof frame.event === "object") {
+    const event = frame.event as {
+      id?: unknown;
+      type?: unknown;
+      data?: unknown;
+    };
+    if (typeof event.id === "number" && typeof event.type === "string") {
+      return {
+        t: "event",
+        event: {
+          id: event.id,
+          type: event.type as RealtimeEventType,
+          data:
+            event.data && typeof event.data === "object"
+              ? (event.data as Record<string, unknown>)
+              : {},
+        },
+      };
+    }
+  }
+  return null;
+}

package/src/backend/index.ts

@@ -4,8 +4,12 @@ import { NOTIFICATION_PUSHER_REGISTRATION_PATH } from "./lib/notification-pusher
 import type { Env, EnvVars, Variables } from "./types.ts";
 import { extractActorFromSession } from "./lib/session-actor.ts";
 import { isBackendPath } from "./lib/backend-paths.ts";
-import { wrapCloudflareBindings } from "./runtime/cloudflare.ts";
 import {
+  wrapCloudflareBindings,
+  wrapCloudflareMessageBatch,
+} from "./runtime/cloudflare.ts";
+import {
+  getMobileOidcAudience,
   getOidcClientCredentials,
   getOidcIssuerUrl,
 } from "./lib/oauth-providers.ts";
@@ -30,6 +34,8 @@ import { appsApiRoutes, appsServeRoutes } from "./routes/apps.ts";
 import mobileRoutes from "./routes/mobile.ts";
 import notificationPusherRoutes from "./routes/notification-pushers.ts";
 import rtcRoutes from "./routes/rtc/index.ts";
+import realtimeRoutes from "./routes/realtime/index.ts";
+import { sweepRealtimeNotifications } from "./runtime/realtime-hub.ts";
 
 import { rateLimit, RateLimitConfigs } from "./middleware/rate-limit.ts";
 import { csrfProtection } from "./middleware/csrf.ts";
@@ -42,7 +48,15 @@ import { logger } from "./lib/logger.ts";
 
 const log = logger.child({ component: "backend.index" });
 let lastNotificationPushRecoverySweep = 0;
-import type { MessageBatch } from "@cloudflare/workers-types";
+import type { IQueueBatch } from "./runtime/queue.ts";
+import type {
+  D1Database,
+  Fetcher,
+  KVNamespace,
+  MessageBatch,
+  Queue,
+  R2Bucket,
+} from "@cloudflare/workers-types";
 import type {
   DeliveryDlqMessageV1,
   DeliveryQueueMessageV1,
@@ -72,6 +86,14 @@ export interface YurucommuBackendPluginV1 {
 export interface CreateYurucommuBackendAppOptionsV1 {
   plugins?: YurucommuBackendPluginV1[];
   discovery?: YurucommuBackendDiscoveryOptionsV1;
+  /**
+   * Browser capture capabilities required by this product shell. Both default
+   * to denied; a product must opt in to each capability it actually uses.
+   */
+  browserMedia?: {
+    camera?: boolean;
+    microphone?: boolean;
+  };
 }
 
 export interface YurucommuBackendDiscoveryClientV1 {
@@ -341,7 +363,7 @@ function mountReadinessRoutes(
   ) => {
     const appUrl = normalizeOrigin(c.env.APP_URL, c.req.url);
     const issuer = getOidcIssuerUrl(c.env) ?? appUrl;
-    const { clientId } = getOidcClientCredentials(c.env);
+    const clientId = getMobileOidcAudience(c.env);
     return c.json(
       buildSocialServerDiscovery(appUrl, issuer, discovery, {
         oidcClientId: getOidcIssuerUrl(c.env)
@@ -502,7 +524,12 @@ function applyBodyLimits(app: YurucommuApp): void {
   });
 }
 
-function applyGlobalMiddleware(app: YurucommuApp): void {
+function applyGlobalMiddleware(
+  app: YurucommuApp,
+  browserMedia: NonNullable<
+    CreateYurucommuBackendAppOptionsV1["browserMedia"]
+  > = {},
+): void {
   app.onError(createErrorMiddleware());
 
   app.use("*", async (c, next) => {
@@ -560,11 +587,14 @@ function applyGlobalMiddleware(app: YurucommuApp): void {
     setSecurityHeader("X-Content-Type-Options", "nosniff");
     setSecurityHeader("X-Frame-Options", "DENY");
     setSecurityHeader("Referrer-Policy", "strict-origin-when-cross-origin");
-    // Allow the app's OWN origin to use camera + microphone (WebRTC calls);
-    // still deny geolocation and deny camera/mic to any cross-origin frame.
+    // Browser capture is product-specific and denied by default. Even when a
+    // capability is enabled, only this origin may use it; cross-origin frames
+    // and geolocation remain denied.
+    const camera = browserMedia.camera === true ? "(self)" : "()";
+    const microphone = browserMedia.microphone === true ? "(self)" : "()";
     setSecurityHeader(
       "Permissions-Policy",
-      "camera=(self), microphone=(self), geolocation=()",
+      `camera=${camera}, microphone=${microphone}, geolocation=()`,
     );
     // HSTS: once a client has reached this host over HTTPS, keep it on HTTPS
     // (defeats SSL-strip / downgrade). Sent unconditionally — browsers ignore it
@@ -600,6 +630,9 @@ function applyGlobalMiddleware(app: YurucommuApp): void {
             error,
           });
         }
+        // Same choke point feeds the realtime stream: the push-jobs the inbox
+        // trigger wrote tell us exactly which users gained a notification.
+        await sweepRealtimeNotifications(c.env);
       })();
       // Prefer to run the sweep AFTER the response is sent (waitUntil) so its
       // 2-4 D1 round-trips never add latency to the request. `executionCtx`
@@ -780,6 +813,8 @@ function mountCoreRoutes(app: YurucommuApp): void {
   app.route("/api/moderation", moderationRoutes);
   app.route("/api/apps", appsApiRoutes);
   app.route("/hosted", appsServeRoutes);
+  // Realtime stream: capability probe + WS ticket + per-user socket upgrade.
+  app.route("/api/realtime", realtimeRoutes);
   // Call feature: /api/rtc/* (session) + /ap/rtc/signal (server-to-server).
   app.route("/", rtcRoutes);
   app.route("/", activitypubRoutes);
@@ -894,7 +929,7 @@ export function createYurucommuBackendApp(
   // /healthz and /readyz stay reachable even when payload validation
   // misbehaves.
   applyBodyLimits(app);
-  applyGlobalMiddleware(app);
+  applyGlobalMiddleware(app, options.browserMedia);
   for (const plugin of plugins) {
     plugin.setup?.(pluginContext);
   }
@@ -916,7 +951,7 @@ const app = createYurucommuBackendApp();
 export const backendApp = app;
 
 export async function handleYurucommuQueueBatch(
-  batch: MessageBatch<DeliveryQueueMessageV1 | DeliveryDlqMessageV1>,
+  batch: IQueueBatch<DeliveryQueueMessageV1 | DeliveryDlqMessageV1>,
   env: Env,
 ): Promise<void> {
   const deliveryQueueName = env.DELIVERY_QUEUE_NAME ?? "yurucommu-delivery";
@@ -924,13 +959,13 @@ export async function handleYurucommuQueueBatch(
 
   if (batch.queue === deliveryQueueName) {
     return handleDeliveryQueueBatch(
-      batch as MessageBatch<DeliveryQueueMessageV1>,
+      batch as IQueueBatch<DeliveryQueueMessageV1>,
       env,
     );
   }
   if (batch.queue === deliveryDlqName) {
     return handleDeliveryDlqBatch(
-      batch as MessageBatch<DeliveryDlqMessageV1>,
+      batch as IQueueBatch<DeliveryDlqMessageV1>,
       env,
     );
   }
@@ -953,6 +988,10 @@ type WorkerBindings = EnvVars & {
   // spreads it through untouched (it is not DB/MEDIA/KV/ASSETS) so app code and
   // the rtc routes read it as c.env.CALL_SIGNALING.
   CALL_SIGNALING?: DurableObjectNamespace;
+  // Per-user realtime event stream Durable Object namespace. Same pass-through
+  // as CALL_SIGNALING; optional — when unbound the realtime routes answer 503
+  // and clients fall back to polling.
+  REALTIME_STREAM?: DurableObjectNamespace;
 };
 
 export default {
@@ -968,6 +1007,9 @@ export default {
     batch: MessageBatch<DeliveryQueueMessageV1 | DeliveryDlqMessageV1>,
     bindings: WorkerBindings,
   ): Promise<void> {
-    return handleYurucommuQueueBatch(batch, wrapCloudflareBindings(bindings));
+    return handleYurucommuQueueBatch(
+      wrapCloudflareMessageBatch(batch),
+      wrapCloudflareBindings(bindings),
+    );
   },
 };

package/src/backend/lib/delivery/queue-batching.ts

@@ -3,8 +3,8 @@
  * and batch dispatch of delivery messages.
  */
 
-import type { Message, MessageBatch } from "@cloudflare/workers-types";
 import type { Env } from "../../types.ts";
+import type { IQueueMessage } from "../../runtime/queue.ts";
 import type { Database } from "../../../db/index.ts";
 import { and, eq, or, sql } from "drizzle-orm";
 import {
@@ -117,12 +117,17 @@ export async function enqueueFollowerEndpointDeliveries(
   baseUrl: string,
   activityId: string,
   followeeApId: string,
-): Promise<{ processed: number; capped: boolean }> {
+  startCursor: string | null = null,
+): Promise<{
+  processed: number;
+  capped: boolean;
+  nextCursor: string | null;
+}> {
   // Page through accepted followers with a keyset cursor instead of loading
   // every row into memory at once. Each page is planned and dispatched in
   // ≤100-message chunks before the next page is read, bounding both memory
   // and per-call batch size.
-  let cursor: string | null = null;
+  let cursor: string | null = startCursor;
   let processed = 0;
   let capped = false;
 
@@ -184,7 +189,7 @@ export async function enqueueFollowerEndpointDeliveries(
     }
   }
 
-  return { processed, capped };
+  return { processed, capped, nextCursor: capped ? cursor : null };
 }
 
 /**
@@ -215,21 +220,27 @@ export async function snapshotAndEnqueueFollowerDeliveries(
     return;
   }
 
-  const { processed, capped } = await enqueueFollowerEndpointDeliveries(
-    db,
-    queue,
-    env.APP_URL,
-    activityId,
-    followeeApId,
-  );
+  let cursor: string | null = null;
+  let processed = 0;
+  do {
+    const page = await enqueueFollowerEndpointDeliveries(
+      db,
+      queue,
+      env.APP_URL,
+      activityId,
+      followeeApId,
+      cursor,
+    );
+    processed += page.processed;
+    cursor = page.nextCursor;
+  } while (cursor !== null);
 
-  if (capped) {
-    log.warn("Follower snapshot delivery capped at max followers", {
-      event: "delivery.fanout.snapshot_capped",
+  if (processed > FANOUT_MAX_FOLLOWERS) {
+    log.info("Follower snapshot continued across bounded pages", {
+      event: "delivery.fanout.snapshot_continued",
       followee: followeeApId,
       activityId,
       processed,
-      max: FANOUT_MAX_FOLLOWERS,
     });
   }
 }
@@ -238,32 +249,38 @@ export async function processFanoutFollowers(
   db: Database,
   env: Env,
   msg: DeliveryFanoutFollowersMessageV1,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): Promise<void> {
   if (!requireQueue(env, "fanout", message)) return;
   const queueEnv = env as QueueEnv;
 
-  const { processed, capped } = await enqueueFollowerEndpointDeliveries(
-    db,
-    queueEnv.DELIVERY_QUEUE,
-    env.APP_URL,
-    msg.activityId,
-    msg.followeeApId,
-  );
+  const { processed, capped, nextCursor } =
+    await enqueueFollowerEndpointDeliveries(
+      db,
+      queueEnv.DELIVERY_QUEUE,
+      env.APP_URL,
+      msg.activityId,
+      msg.followeeApId,
+      msg.cursor ?? null,
+    );
 
-  if (capped) {
-    // Extremely large follower sets are capped per invocation to keep the
-    // Worker within CPU/time limits. Endpoint-deduped delivery jobs are
-    // idempotent (computeDeliveryJobId + upsertDeliveryJob), and the planner
-    // re-enqueues any still-unknown recipients on the next fanout, so capped
-    // followers are re-planned on the actor's next delivery rather than lost
-    // silently.
-    log.warn("Fanout capped at max followers for one invocation", {
-      event: "delivery.fanout.capped",
+  if (capped && nextCursor !== null) {
+    // Send the continuation before ACK. If this send fails, Cloudflare retries
+    // the current message; deterministic endpoint job ids make that safe.
+    await sendQueueMessage(env, {
+      version: DELIVERY_QUEUE_MESSAGE_VERSION,
+      type: "fanout_followers",
+      activityId: msg.activityId,
+      followeeApId: msg.followeeApId,
+      cursor: nextCursor,
+      scheduledAt: nowIso(),
+    });
+    log.info("Follower fanout continued from stable cursor", {
+      event: "delivery.fanout.continued",
       followee: msg.followeeApId,
       activityId: msg.activityId,
       processed,
-      max: FANOUT_MAX_FOLLOWERS,
+      cursor: nextCursor,
     });
   }
 
@@ -288,7 +305,7 @@ export async function processFanoutCommunity(
   db: Database,
   env: Env,
   msg: DeliveryFanoutCommunityMessageV1,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): Promise<void> {
   const baseUrl = env.APP_URL;
 
@@ -456,7 +473,7 @@ export async function processResolveActor(
   db: Database,
   env: Env,
   msg: DeliveryResolveActorMessageV1,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): Promise<void> {
   if (!requireQueue(env, "resolve_actor", message)) return;
 
@@ -554,7 +571,7 @@ export async function processReconcileJob(
   db: Database,
   env: Env,
   msg: DeliveryReconcileJobMessageV1,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): Promise<void> {
   if (!requireQueue(env, "reconcile", message)) return;
 

package/src/backend/lib/delivery/queue-delivery.ts

@@ -3,7 +3,7 @@
  * Includes signing, circuit breaker checks, retry logic, and dead-letter handling.
  */
 
-import type { Message } from "@cloudflare/workers-types";
+import type { IQueueMessage } from "../../runtime/queue.ts";
 import type { Env } from "../../types.ts";
 import type { Database } from "../../../db/index.ts";
 import { and, eq, lt, notInArray, or, sql } from "drizzle-orm";
@@ -186,7 +186,7 @@ async function failJob(
   db: Database,
   jobId: string,
   error: string,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
 ): Promise<void> {
   await db
     .update(deliveryQueue)
@@ -286,7 +286,7 @@ export async function processDeliverEndpoint(
   db: Database,
   env: Env,
   msg: DeliveryDeliverEndpointMessageV1,
-  message: Message<DeliveryQueueMessageV1>,
+  message: IQueueMessage<DeliveryQueueMessageV1>,
   bulkhead: Bulkhead,
 ): Promise<void> {
   if (!requireQueue(env, "deliver_endpoint", message)) return;